A domain can fail to load, or email can bounce, for reasons that have nothing to do with the server itself. This DNS lookup tool answers the first diagnostic question: what do the records actually say? Enter a domain, choose one or more record types, and the page fetches live answers from Cloudflare’s encrypted DNS-over-HTTPS resolver, showing each value and its TTL.
What Each Record Type Answers
| Type | Question it answers |
|---|---|
| A | Which IPv4 address does this name point to? |
| AAAA | Which IPv6 address does this name point to? |
| CNAME | Is this name an alias for another name? |
| MX | Where should email for this domain be delivered, and in what priority? |
| TXT | What free-form text is published, such as SPF, DKIM, or verification strings? |
| NS | Which name servers are authoritative for the zone? |
| SOA | What are the zone’s primary name server, contact, and serial metadata? |
An empty result for a type simply means no record of that type exists. Plenty of domains have A records but no AAAA, and most have no TXT records unless they were deliberately added.
How to Run a Lookup
Type a domain such as example.com and select the record types you want using the checkboxes. A, AAAA, MX, and NS are selected by default; CNAME, TXT, and SOA must be enabled manually. Press Lookup or hit Enter, and the tool queries each selected type independently, so one slow record type does not block the others.
The query is sent over HTTPS to cloudflare-dns.com, which means the request and the domain you are asking about are visible to Cloudflare. That is an honest trade-off: the tool needs a resolver to return authoritative answers, and it uses an encrypted public one rather than your operating system’s resolver.
Reading the Results
Results are grouped into a card per record type. Each row shows the record name, the value, and the TTL in seconds. For MX records the value includes the priority and the mail host. For TXT records the value is the raw string, which often starts with v=spf1 for SPF or a selector for DKIM. NS records list the delegated name servers, and SOA records show the primary server and serial number that secondaries use to detect zone changes.
Worked Examples
Mail routing. Looking up gmail.com for MX typically returns five records: gmail-smtp-in.l.google.com at priority 5, then alt1 through alt4.l.google.com at priorities 10, 20, 30, and 40. The lowest number wins, and the rest are backups.
An alias. Querying www.example.com for CNAME often returns a single canonical name, while querying the apex example.com for A returns one or more IPv4 addresses. If the CNAME target is in another zone, run a second lookup on that target to see its A or AAAA records.
Verification text. A TXT lookup on a domain configured for email commonly shows an SPF string such as v=spf1 include:_spf.google.com ~all. Multiple TXT records can exist at the same name, so read them all rather than assuming the first is the only one.
Diagnosing Email with MX and TXT
Email problems usually show up in two record types. MX records tell sending servers where to deliver mail, and TXT records carry the policies that decide whether that mail is trusted.
If a message bounces with “no MX records,” check the MX lookup first and confirm the mail host names are spelled correctly and that the lowest-numbered priority points at a reachable server. If mail is delivered but lands in spam, look at TXT records. An SPF record beginning with v=spf1 lists the servers allowed to send for the domain; a DKIM record under a selector such as selector._domainkey contains a public key; and a DMARC record starting with v=DMARC1 tells receivers what to do with failures. Missing, duplicated, or contradictory records here are common causes of deliverability trouble.
Because these records are just text, a single typo or an extra character breaks the policy silently. Compare the returned strings character by character with what your provider told you to publish, and remember that a domain can legitimately have several TXT records at once, so read all of them.
TTL and Why Changes Lag
TTL stands for Time To Live: the number of seconds a resolver may cache an answer before asking again. A low TTL, such as 300, makes changes propagate in about five minutes but increases query volume. A high TTL, such as 86,400, reduces load but can hide a change for a full day. When you are preparing to migrate, lowering the TTL well in advance shortens the window in which some visitors still see the old address.
Common Problems and Misreadings
- Reading an empty type as an outage. No AAAA record is not the same as a broken site; check A first.
- Confusing registrar settings with live records. NS records in a lookup show what the internet sees, which may differ from what a control panel displays while changes propagate.
- Misreading MX priority. Lower numbers are preferred, so priority 5 is tried before 10.
- Assuming one answer is the only answer. CDNs and load balancers return several addresses, and the order can rotate.
- Forgetting the default checkboxes. If you expect TXT or CNAME results, make sure that type is selected before concluding it is missing.
Related Tools
Frequently Asked Questions
Who processes my DNS query when I use this tool?
The lookup is sent to Cloudflare's DNS-over-HTTPS resolver at cloudflare-dns.com, so Cloudflare sees the domain you ask about. This site has no backend and does not log or store the query, but the request does leave your browser and reach a third-party resolver. That is how any public DNS lookup works.
Why does an MX record start with a number like 5 or 10?
That number is the priority, and lower values are tried first. A common setup for gmail.com lists gmail-smtp-in.l.google.com at priority 5 and four alt servers at 10, 20, 30, and 40, which are fallbacks if the primary is unreachable. If two hosts share a priority, senders may use either.
Why is there no AAAA record for a domain that loads fine?
Not every site publishes IPv6 addresses. If a domain has only A records, it is reachable over IPv4 but not directly over IPv6 without a proxy or a NAT64 gateway. An empty AAAA result means no IPv6 record was returned, not that the domain is broken.
Why do repeated lookups return different IP addresses?
Many large sites use round-robin DNS or a load balancer, publishing several A or AAAA records and rotating the order. Different resolvers also keep different cached copies, so two lookups seconds apart can legitimately show different addresses and TTLs. This is normal for high-traffic domains.
Why has my new record not appeared after I changed it?
Resolvers cache each answer for the record's TTL, so an old value can linger for as long as the previous TTL. A record with a 3,600-second TTL may take an hour to update everywhere; one with a 60-second TTL updates in about a minute. The TTL column shows how long the answer you are seeing is valid.
Why can I not add a CNAME at my root domain?
The DNS standard does not allow a CNAME to coexist with the NS and SOA records that a zone apex requires. Many providers work around this with flattened or ALIAS records that resolve to A and AAAA answers, so a lookup of your apex returns addresses rather than a CNAME. This is expected, not a misconfiguration.
Reviewed by the HandyTools Hub team · Last updated